1. Field of the Invention
The present invention relates to an image forming apparatus and an analysis method, and more specifically, to a technique for performing analysis of errors that have occurred in apparatuses using packets.
2. Description of the Related Art
Techniques have been developed in which when a fault has occurred in a network communication device, packets delivered over networks (communication lines) are extracted to investigate the cause of the fault. In a typical example of such techniques, a dedicated device used to obtain packets is connected to a line concentrator such as a hub to extract packets delivered over a local area network (LAN). The content of data of packets transmitted and received by a target network communication device to be investigated is determined using analysis of the extracted packets to specify a portion that has received unacceptable data or a portion where a response delay to a received packet has occurred. In order to determine whether or not such a portion is the cause of the fault, an investigation is performed. For example, the same packet is transmitted to the network communication device to check the recurrence of the fault, or a source code that controls communications of the network communication device is analyzed.
In such a process of obtaining packets or performing analysis of packets, in order to reserve a storage area of a packet obtaining device and reduce the load of the analysis of packets, a filtering function of a packet is used. With the use of the filtering function, only packets matching a specific condition can be obtained. Thus, the number of packets to be obtained can be reduced to reduce the capacity of a memory area for storing the obtained packets or a storage area of a hard disk for storing the obtained packets for a long time. In addition, the number of steps required for the analysis can be reduced. Filtering rules are generally specified by elements of network protocols. For example, only a specific protocol, such as Internet Protocol (IP) or Address Resolution Protocol (ARP), is filtered so that only packets according to the protocol can be obtained. In each protocol, more detailed filtering based on elements is also possible. For example, in the IP protocol, detailed filtering can be performed by setting conditions such as a specific transmission destination address (DST address), a specific transmission source address (SRC address), and a specific upper-layer protocol.
Recently, network communication devices having a packet obtaining function have become widely used. Such network communication devices are capable of obtaining packets without using dedicated devices to obtain packets. Thus, it is possible to obtain packets even in an environment where it is difficult to correctly obtain packets if a dedicated device is connected, such as an environment where a switching hub is installed. In addition, recently, filtering techniques specific to the application of network devices as well as the functionality thereof have become available. In such filtering techniques, unlike the filtering technique described above in which filtering is performed in units of network protocol elements, filtering specific to the functions of devices is performed. This enables more efficient fault analysis. Japanese Patent Laid-Open No. 2004-362386 discloses a technique of storing data for every print job received by a network printer. With this technique, in order to analyze a fault that has occurred during printing of print jobs received via a network, only a print job in which the fault has occurred can be extracted, and the efficiency of analysis can be improved.
However, the technique of the related art described above has problems as follows.
A first problem is that due to the filtering, it is difficult to perform comparison with print jobs under normal conditions. As in the technique of the related art described above, as a result of filtering performed for every print job, a fault analyzer can only obtain packets associated with a print job in which a fault has occurred. Therefore, if a communication failure that can cause a fault is found in the obtained packets, it is difficult to determine whether or not the communication failure is the cause of the fault. For example, in a case where an event that can cause a fault, such as retransmission of a packet or transmission retry, has occurred in an obtained print job, if this event also occurs in a print job that can correctly be printed, the probability that the event causes the fault may be low. In the technique of the related art, however, it is necessary to investigate all communication failures detected in packets, and a large load is imposed on the analyzer.
Another problem is that although the number of packets can be relatively reduced by performing filtering, if the absolutely number of packets (amount of data) is large, a long time is required for the analysis. With the recent increase in the complexity and functionality of network applications, the size of data delivered over networks has also increased. In the technique of the related art, filtering is performed for every print job received by a network printer. Since recent network printers may receive a print job larger than 1 gigabyte in data size, a large amount of time is required for an analyzer to analyze packet data of 1 gigabyte.